Privacy Policy

Account information

When you sign up for Bevel, we collect your name, email address, and company name. If you enable SMS notifications, we also collect the mobile phone number you provide in your notification settings. If you subscribe to a paid plan, your payment is processed by Stripe — we don't store your credit card number.

Project data

You can upload documents to Bevel — receipts, plans, contracts, photos, and other project files. This content is stored in your account and used to provide the service. We treat construction plans, specifications, and project financials as confidential business documents: they are stored in private storage, isolated to your organization, and processed only to provide the features you use.

Photos

Jobsite photos you upload may contain embedded metadata from your camera, such as the time and GPS coordinates where the photo was taken. Bevel may read this metadata to organize photos by date and location within your projects.

Voice recordings

If you use voice features — voice punchlist walkthroughs, voice notes, or AI meeting notes — we process the audio you record to produce transcripts and structured items. Audio is transcribed by our AI providers (see AI Processing below) and is not used to train AI models.

Location data

Project addresses you enter are geocoded so we can show jobsite weather and maps. If your organization enables location-based time clock features, we collect your device's location at clock-in/clock-out to verify presence at the jobsite — only when you use those features, never as continuous background tracking.

Usage data

We collect information about how you use Bevel — which features you use, when you log in, what pages you visit, and general activity within the app. We use this to improve the product.

Device and connection data

Standard web server logs: your IP address, browser type, and operating system. We don't use this to identify you individually.

Microsoft Teams integration

If your organization connects a Microsoft Teams channel to a Bevel project, the Bevel bot receives only the messages addressed to it — a message beginning with the /task command, or one that @mentions the bot. It is not a channel-wide listener: Microsoft does not deliver the rest of your channel's conversation to it. We store the command text, the identity of the sender (mapped to their Bevel user), the channel-to-project connection, and the technical references needed to reply into the channel. The Teams bot itself uses no Microsoft Graph permissions: it cannot read your mailboxes, files, calendars, or directory. (Bevel's Microsoft app also carries one separate, opt-in permission for the Outlook calendar integration below. The bot does not use it, and it reads nothing until a person connects their own calendar.) Disconnecting the channel stops this collection; Teams-derived records follow the same retention as the rest of your account data (see How We Store Your Data below).

Outlook calendar integration

If your organization turns this on, each person can choose to show their own Outlook calendar inside Bevel. It is opt-in, one person at a time: nothing is shared until you open Bevel, press Connect Outlook, and sign in to Microsoft yourself.

What we ask Microsoft for. Read-only access to your own calendar (Microsoft calls it Calendars.Read), plus permission to keep it up to date without you signing in again (offline_access), and the basic sign-in details that tell us which Microsoft account you connected. We cannot create, change, or delete your events, and we cannot see anyone else's calendar, your email, your contacts, or your files.

What we store. For each event: its title, start and end time (or all-day date), location, whether it's cancelled, how it shows (busy, free, and so on) and its privacy setting, the organizer's name and whether you are the organizer, your reminder setting, the link to open it in Outlook, and Outlook's reference IDs so we can keep it in sync. We do not store event descriptions or attendee lists. For the connection itself we keep your Microsoft account name and IDs, sync status, and a sign-in token that is encrypted with a key kept outside our database. Your mirrored events are visible only to you in Bevel, not to the rest of your company.

Your company's approval. Microsoft requires an IT administrator to approve this permission once for the organization. That approval on its own shares no one's calendar. Each person still decides for themselves whether to connect.

Disconnecting. Press Disconnect on Bevel's calendar page at any time. We then delete your mirrored events, erase your sign-in token, and cancel the change notifications Microsoft sends us. Your Outlook calendar itself is never touched. If access is withdrawn on Microsoft's side instead (for example in your Microsoft account's app settings, or by your administrator), syncing stops and Bevel shows “reconnect needed”. Events already mirrored stay visible only to you, clearly marked as out of date, until you reconnect or disconnect. Deleting your Bevel account deletes the connection and every mirrored event with it.

Email sent to Bevel reply addresses

Bevel gives organizations email addresses ending in @reply.bevel.build, for example a project's capture address or the address a subcontractor replies to when answering a bid invitation or an RFI. Mail sent to these addresses is received for us by our email provider, Resend. People who send it are often not Bevel users and have not agreed to these terms, so this section is written for them too.

What we store. The sender's name and email address, the other recipients and anyone copied, the subject, the message text, and any attachments.

What happens to it. The message belongs to the organization it was addressed to. When we can match it confidently, we file it there: its attachments go to the right project's documents, a bid reply goes to its bid package, and an authenticated reply can record a response on an RFI, submittal or change order that organization sent. When we cannot match it confidently, or when the sender's email fails the standard checks that it really came from that address, we hold it for a person at that organization to review and never file it automatically. Our AI provider may read the message to classify and summarize it, and we scan it for malicious instructions before any AI sees it (see AI Processing below).

Who can see it, and for how long. Members of the organization it was addressed to can see it, like the rest of that organization's project records. It is kept under the same retention rules as the rest of that organization's data (see How We Store Your Data below). If you emailed one of these addresses and want a copy of what was stored, or want it deleted, contact the organization you emailed, or email privacy@bevel.build and we will help.

Cookies

We use two types of cookies: an authentication token (keeps you logged in) and preference cookies (saves your settings like column layouts and display preferences). We don't use advertising cookies or third-party tracking cookies, and our analytics (Vercel Web Analytics and Speed Insights) are cookieless and anonymized. Full details in our Cookie Policy.